SYSTEM AND METHOD FOR SUPPORTING DIGITAL RIGHTS MANAGEMENT IN AN ENHANCED JAVATM 2 RUNTIME ENVIRONMENT

• US 20080060083A1
• Filed: 10/31/2007
• Published: 03/06/2008
• Est. Priority Date: 02/23/2001
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Munson, Jonathan, Youssef, Alaa, Mourad, Magda, Pistoia, Marco, Koved, Lawrence, Pacifici, Giovanni
• Granted Patent: US 7,827,613 B2
• Time in Patent Office: Days
• US Class Current: 726/27
• CPC Class Codes: G06F 21/1066 Hiding content
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow

Abstract

A digital rights management (DRM) system and methodology for a Java client implementing a Java Runtime Environment (JRE). The JRE comprises a Java Virtual Machine (JVM) and Java runtime libraries components and is capable of executing a player application for presenting content that can be presented through a Java program (e.g., a Java application, applet, servlet, bean, etc.) and downloaded from a content server to the client. The DRM system includes an acquisition component for receiving downloaded protected contents; and a dynamic rights management layer located between the JRE and player application for receiving requests to view or play downloaded protected contents from the player, and, in response to each request, determining the rights associated with protected content and enabling viewing or playing of the protected contents via the player application if permitted according to the rights. By providing a DRM-enabled Java runtime, which does not affect the way non-DRM-related programs work, DRM content providers will not require the installation of customized players. By securing the runtime, every Java™ player automatically and transparently becomes a DRM-enabled player.

Claims

1. A digital rights management (DRM) system for a Java client implementing a Java Runtime Environment (JRE) comprising Java Virtual Machine (JVM) and Java runtime libraries components, said JRE capable of executing a player application for presenting content downloaded or streamed from a content server to a user, said system comprising:

a) acquisition component for receiving downloaded or streamed protected contents; and

b) dynamic rights management layer located between said JRE and player application for receiving requests to view or play protected contents from said player, and, in response to each request, determining the rights associated with protected content and enabling viewing or playing of said protected contents via said player application if permitted according to said rights, wherein digital rights management functionality is assured in a manner transparent to said user and without the need for a customized player application.

2. The digital rights management (DRM) system as claimed in claim 1, wherein said protected contents are encrypted, said dynamic rights management layer further comprising:

protocol handler component for decrypting said protected contents, checking the rights that the user has acquired according to a rights policy, and accessing said components for said viewing or playing via said player application

3. The digital rights management (DRM) system as claimed in claim 2, wherein dynamic rights management layer further comprises:

security manager component in secure communications with said protocol handler component for preventing any input/output operation that may lead to a rights violation when protected digital contents are loaded into said JVM, wherein digital rights management functionality is assured without comprising a security function of said JVM as it relates to non-protected contents.

4. The digital rights management (DRM) system as claimed in claim 1, wherein said input/output operations includes one or more of:

printing, saving unencrypted content to a disk or memory system, and opening sockets for communicating content to external entities which could violate the rights associated with the content.

5. The digital rights management (DRM) system as claimed in claim 3, wherein said security manager component is a Java class that subclasses an original security manager class of the JRE, and prevents any further subclassing of itself.

6. The digital rights management (DRM) system as claimed in claim 2, further comprising a launcher application for launching said JVM and verifying the integrity of the JRE prior to said launching.

7. The digital rights management (DRM) system as claimed in claim 6, wherein the protocol handler communicates securely with the launcher to verify that the JRE was authenticated.

8. The digital rights management (DRM) system as claimed in claim 3, wherein said user rights are encoded on a local or remote file system and encrypted with a secret key, wherein for each attempted access of protected content said protocol handler component accessing a decrypting key, and implementing decrypting functions to access said rights, and communicating the rights securely to said security manager component.

9. The digital rights management (DRM) system as claimed in claim 3, wherein said user rights are encoded on a local or remote file system and encrypted with a secret key, wherein for each attempted access of protected content said security manager component accessing a decrypting key, and implementing decrypting functions to access said rights.

10. The digital rights management (DRM) system as claimed in claim 9, wherein said security manager component functions to access said rights associated with content that is not enforced through said protocol handler.

11. The digital rights management (DRM) system as claimed in claim 8, wherein said acquisition component comprises mechanism for securely exchanging keys with a trusted remote clearing house entity for decrypting/encrypting said protected content.

12. The digital rights management (DRM) system as claimed in claim 8, wherein said protocol handler component further includes mechanism for decrypting the content and reencrypting it with a local key that is not exposed and is unknown to a user.

13. The digital rights management (DRM) system as claimed in claim 8, wherein all components of said dynamic rights management layer are given a public-key certificate by a certificate authority that all the entities in the system trust.

14. The digital rights management (DRM) system as claimed in claim 4, wherein said protocol handler and security manager components are obfuscated within the JVM.

15. A method for protecting digital rights associated with protected content downloaded to a Java client implementing a Java Runtime Environment (JRE) comprising Java Virtual Machine (JVM) and Java runtime libraries components, and a player application for presenting content downloaded or streamed from a content server to a user, said method comprising the steps of:

a) receiving requests to view or play downloaded or streamed protected contents from said player, and,

b) in response to each request, determining the rights associated with protected content and enabling viewing or playing of said protected contents via said player application if permitted according to said rights, wherein digital rights management functionality is assured in a manner transparent to said user and without the need for a customized player application.

16. The method for protecting digital rights as claimed in claim 15, wherein the step b) of determining rights includes the steps of:

loading a digital rights management protocol handler unit associated with a protocol indicated by the name of the uniform resource locator (URL) of the protected content being accessed;

loading a rights set associated with that particular resource; and

determining whether the particular user has the right to play, view, or listen to said protected contents.

17. The method for protecting digital rights as claimed in claim 16, wherein as a result of said determining step, the step of preventing access to said contents if no rights are detected.

18. The method for protecting digital rights as claimed in claim 16, wherein as a result of said determining step, the steps of:

decrypting rights files to obtain a set of rights associated with said user; and

if the user has rights associated with the protected content, creating objects to be passed to a security manager component for enforcing said rights as determined for that user.

19. The method for protecting digital rights as claimed in claim 18, further including the steps of:

initializing an input stream object for said player application and a decryption filter that may be utilized in order to view or listen or play said contents; and

,

delivering said input stream object to said player application and decrypting, in real time, said input object stream utilizing said decryption filter, for playing said protected content.

20. The method for protecting digital rights as claimed in claim 18, wherein said step of enforcing said rights includes the step of preventing any input/output operation that may lead to a rights violation when protected digital contents are loaded into said JVM, said input/output operations including one or more of:

printing, saving unencrypted content to a disk or memory system, and opening sockets for communicating content to external entities which could violate the rights associated with the content.

21. The method for protecting digital rights as claimed in claim 18, wherein prior to said step of loading a digital rights management protocol handler unit, the steps of:

launching said JVM component; and

,

verifying the integrity of the JRE prior to said launching.

22. The method for protecting digital rights as claimed in claim 21, wherein said step of decrypting rights files to obtain a set of rights associated with said user comprises the steps of:

resolving the resource URL in order to determine a content filename (CF) and the content map (CM) of that resource;

decrypting said content map using a hidden private key;

utilizing the CM to map the CF into a corresponding rights file (RF) and key ID; and

,

decrypting the RF using the hidden private key.

23. The method for protecting digital rights as claimed in claim 22, wherein after said step of decrypting said RF, the steps of:

parsing the decrypted rights files to obtain a set of rights associated with said user; and

loading said rights set for the security manager to enforce.

24. A program storage device readable by machine, tangibly embodying a program of instructions executable by the machine to perform method steps for protecting digital rights associated with protected content downloaded or streamed to a Java client implementing a Java Runtime Environment (JRE) comprising Java Virtual Machine (JVM) and Java runtime libraries components, and a player application for presenting content downloaded or streamed from a content server to a user, said method comprising the steps of:

a) receiving requests to view or play downloaded protected contents from said player, and,

b) in response to each request, determining the rights associated with protected content and enabling viewing or playing of said protected contents via said player application if permitted according to said rights, wherein digital rights management functionality is assured in a manner transparent to said user and without the need for a customized player application.

25. The program storage device readable by machine as claimed in claim 24, wherein the step b) of determining rights includes the steps of:

loading a digital rights management protocol handler unit associated with a protocol indicated by the name of the uniform resource locator (URL) of the protected content being accessed;

loading a rights set associated with that particular resource; and

determining whether the particular user has the right to play, view, or listen to said protected contents.

26. The program storage device readable by machine as claimed in claim 24, wherein as a result of said determining step, the step of preventing access to said contents if no rights are detected.

27. The program storage device readable by machine as claimed in claim 24, wherein as a result of said determining step, the steps of:

decrypting rights files to obtain a set of rights associated with said user; and

if the user has rights associated with the protected content, creating objects to be passed to a security manager component for enforcing said rights as determined for that user.

28. The program storage device readable by machine as claimed in claim 27, further including the steps of:

initializing an input stream object for said player application and a decryption filter that may be utilized in order to view or listen or play said contents; and

,

delivering said input stream object to said player application and decrypting, in real time, said input object stream utilizing said decryption filter, for playing said protected content.

29. The program storage device readable by machine as claimed in claim 27, wherein said step of enforcing said rights includes the step of preventing any input/output operation that may lead to a rights violation when protected digital contents are loaded into said JVM, said input/output operations including one or more of:

printing, saving unencrypted content to a disk or memory system, and opening sockets for communicating content to external entities which could violate the rights associated with the content.

30. The program storage device readable by machine as claimed in claim 27, wherein prior to said step of loading a digital rights management protocol handler unit, the steps of:

launching said JVM component; and

,

verifying the integrity of the JRE prior to said launching.

31. The program storage device readable by machine as claimed in claim 30, wherein said step of decrypting rights files to obtain a set of rights associated with said user comprises the steps of:

resolving the resource URL in order to determine a content filename (CF) and the content map (CM) of that resource;

decrypting said content map using a hidden private key;

utilizing the CM to map the CF into a corresponding rights file (RF) and key ID; and

,

decrypting the RF using the hidden private key.

32. The program storage device readable by machine as claimed in claim 31, wherein after said step of decrypting said RF, the steps of:

parsing the decrypted rights files to obtain a set of rights associated with said user; and

loading said rights set for the security manager to enforce.